Important PHP security update: What website owners need to do

PHP, the programming language behind most of the web, released an emergency fix for two critical vulnerabilities on Wednesday, October 21, 2026 at 14:00 UTC (10:00 AM ET). If your server, website or web application runs on PHP, update as soon as you can. This article explains what's happening and what you need to do.

Note: This is an industry-wide vulnerability in the open-source PHP language that affects all hosting providers. It is not specific to GoDaddy.

What is the vulnerability?

The PHP security team has released fixes for two flaws, both rated Critical (CVSS v4.0 9.2). Both are remote code execution vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. A flaw like this could let an attacker run their own code on an affected server over the internet, which can lead to stolen data, a defaced site, or a full takeover.

PHP says the flaws affect PHP 8.5, 8.4, 8.3 and 8.2, as well as older unsupported versions. They are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Full technical details are in PHP's security release announcement.

Is my site affected?

If you use PHP, you may be affected. What you need to do depends on where your site is hosted.

• Managed Hosting for WordPress: We have patched all PHP versions. You don't need to take any action.
• Windows Hosting: We have patched all PHP versions. You don't need to take any action.
• Web Hosting: We have patched all PHP versions. You don't need to take any action. Your PHP version number may not change. Here's why, and how to check.
• VPS: Since you manage your server's software, you'll want to update PHP yourself. The steps below walk you through it, or our Expert Services team can do it for you.
• Hosted with another provider: Check with your provider. If you manage your own server, follow the steps below.

If you manage your own VPS server

• Sites and apps running PHP (WordPress, WooCommerce, Drupal, Joomla, Magento, Laravel, and others): Assume yes, until you have updated to the fixed release.
• Sites running PHP 8.1 or older: PHP no longer supports these versions and will not release an official fix for them. Some providers have backported the fix, including cPanel's EasyApache 4 packages for PHP 7.4, 8.0 and 8.1. Even so, plan to upgrade to a supported version (8.2 or later).

Follow the "How to update PHP" section below, which at a high level will require you to:

1. Update PHP to the fixed release for your version.
2. Restart PHP and your web server so the update takes effect.
3. Verify that your site is running the updated version.

PHP publishes the fix first. Operating system vendors, control panels, and hosting providers then release their own updates on their own schedules. Check the latest status here:

• PHP security release announcement
• cPanel EasyApache 4 change log
• CloudLinux incident update
• Overview from Ars Technica
• Guidance for WordPress sites from Wordfence

How to update PHP

Take a backup first, then update PHP to the fixed release for your version.

• How to change your PHP version in cPanel
• How to change your PHP version in Plesk
• If you run cPanel/WHM on a VPS, install the updated ea-php packages through EasyApache 4 in WHM. See cPanel's EasyApache 4 change log.

If you can't update right away

PHP has published temporary mitigations for both vulnerabilities in its security release announcement. PHP describes them as incomplete. Installing the fixed release is the only complete fix. While you prepare to update:

1. Find every site and server you run on PHP. Note which PHP version each one uses.
2. Review PHP's published mitigations. Some of them change PHP settings that can affect how your site works, such as file upload limits or upload progress bars. Test your site after any change.
3. Turn on automatic updates where available so you get the fix as soon as it reaches your system.
4. Take a backup or snapshot of your site before you update so you can roll back if needed.

How to confirm you are protected

After updating, check your PHP version: php -v

On WordPress, you can also find your PHP version under Tools > Site Health > Info > Server.

Compare it against the fixed versions below. If your site is running that version or newer, you are protected. If you run more than one PHP version, check each one. On Web Hosting, check the build date instead, as explained in the next section.

On Web Hosting? Check the build date, not the version number

Web Hosting uses PHP packages from CloudLinux, which provides security support for both current and end-of-life PHP versions. For this update, CloudLinux backported the security fixes onto the previous PHP release and built new packages, which we've deployed to all Web Hosting servers. These new builds keep the previous version number. That means your site may still report a version like 8.5.11 or 8.2.34 even though it includes the fix. Read CloudLinux's incident update for details.

Because of this, the table above doesn't apply to Web Hosting, and WordPress Site Health won't help here because it shows only the version number. Check the build date instead. Patched packages have a build date of October 21, 2026 or later.

If you use SSH: run php -v and look at the date after "built:".

If you don't use SSH: create a temporary phpinfo page.

1. In cPanel's File Manager, create a file named phpinfo.php in your site's root folder (usually public_html) with this line: <?php phpinfo();
2. Visit yourdomain.com/phpinfo.php and find Build Date near the top of the page.
3. Delete the file as soon as you're done. It shows details about your server's configuration that shouldn't stay public.

If your sites use more than one PHP version, check each one. We've asked CloudLinux for packages whose version numbers match PHP's latest releases for 8.2 through 8.5. Those will take some time, and we'll update this post when they're deployed.

Want help with this?

If you would rather not handle updates yourself, GoDaddy's Expert Services (Do It For You) can apply this update for you on your VPS. Contact support to learn more.